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Mr.  Chairman  and  Members  of  the  Subcommittee: 


Thank  you  for  this  opportunity  to  discuss  the  results  of  recent 
audits  by  the  Office  of  the  Inspector  General,  DoD,  related  to 
the  vitally  important  functions  of  personnel  security  clearance 
investigation  and  adjudication. 

Longstanding  Personnel  Security  Program  Problems 

The  procedures  for  determining  what  type  of  security  clearance 
is  appropriate  for  each  military  and  civilian  position  in  the 
DoD,  conducting  investigations  to  ensure  that  individuals  merit 
the  degree  of  trust  required  for  those  clearances,  and 
adjudicating  cases  where  investigations  reveal  adverse 
information  need  to  be  both  efficient  and  effective.  As  with 
most  DoD  management  challenges,  the  huge  scale  of  the  Defense 
Personnel  Security  Program  makes  it  inherently  difficult  to 
administer.  Several  thousand  security  officers,  located 
throughout  the  Department,  help  managers  to  determine  security 
clearance  requirements  and  handle  the  paperwork  for  requesting 
clearances.  The  Department  estimates  that  more  than  700,000 
initial  investigations  are  needed  annually,  as  well  as  several 
hundred  thousand  reinvestigations  to  update  existing  clearances. 
Approximately  2.4  million  DoD  and  contractor  personnel  hold 
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clearances  at  any  given  time.  Hundreds  of  thousands  of  those 
individuals  change  assignments  during  an  average  year  and 
thousands  of  programs  and  military  units  depend  on  having 
individuals  with  current  clearances  available  to  carry  out  their 
assignments . 

Unfortunately,  as  your  Subcommittee's  hearing  last  February 
indicated,  the  Defense  Personnel  Security  Program  has  serious 
problems.  The  most  widely  publicized  of  those  difficulties  is 
the  excessive  time  required  for  personnel  security 
investigations,  which  has  resulted  in  enormous  backlogs  of 
overdue  clearance  updates.  This  problem  was  considered  critical 
in  the  1980/81  time  frame  and  was  overcome  at  that  time  by 
significantly  increasing  the  staffing  of  the  Defense 
Investigative  Service  (DIS) ,  which  is  now  the  Defense  Security 
Service  (DSS) .  Like  virtually  all  other  Defense  agencies, 
however,  the  DIS  budget  and  staffing  were  drastically  reduced  as 
part  of  the  post-Cold  War  Defense  downsizing.  In  fact,  the 
40  percent  DIS  staffing  reduction  from  4,080  personnel  in 
FY  1989  to  2,448  in  FY  1999  exceeded  the  average  32  percent 
reduction  for  Defense  agencies  during  the  1990' s.  There  was  no 
comparable  reduction  in  the  investigative  workload. 
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With  a  tremendous  volume  of  cases  and  related  data  to  compile, 
analyze  and  report  on,  the  DSS  needs  effective  automated 
information  systems.  However,  the  agency  has  lacked  capable 
information  systems  throughout  its  existence. 

By  1994,  the  combination  of  reduced  staff  and  inadequate  systems 
had  caused  the  backlog  of  reinvestigations  to  grow  again  to 
alarming  proportions.  In  February  1994,  the  Joint  Security 
Commission  reported  that  the  personnel  security  investigative 
process  was  cumbersome,  inefficient  and  in  need  of  reform.  The 
average  time  required  for  a  single  scope  background 
investigation  had  climbed  steadily  from  102  days  in  FY  1989  to 
145  days  in  FY  1994.  Those  numbers  rose  further  to  220  days  in 
FY  1996  and  262  in  early  FY  2000. 

In  May  1996,  the  DIS  became  one  of  about  135  DoD  Reinvention 
Laboratories  and  began  a  multi-year  business  process 
reengineering  effort  intended  to  overcome  the  disparity  between 
workload  and  investigative  resources  by  improving  productivity. 
In  August  1996,  the  Deputy  Secretary  of  Defense  directed  a  study 
of  DIS  workload  and  alternative  ways  to  handle  the  mission, 
including  converting  DIS  to  a  fee  for  service  organization  and 
outsourcing.  The  DIS,  renamed  DSS  in  1997,  responded  with 
additional  measures  intended  to  improve  efficiency,  including  an 
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automated  systems  modernization  effort.  The  centerpiece  of  that 
effort  was  development  of  the  Case  Control  Management  System 
(CCMS) .  In  September  1996,  the  Department  also  created  an 
Integrated  Process  Team,  composed  of  representatives  of  the 
investigative  and  adjudicative  communities,  to  address  the 
numerous  issues  existing  between  those  groups.  This  was  the 
first  of  several  teams  formed  by  the  DoD  over  the  past  few  years 
to  address  management  problems  in  this  area.  In  addition,  the 
DSS  unilaterally  made  numerous  policy  changes  to  streamline  its 
processes . 

As  the  General  Accounting  Office  reported  in  September  1999, 
some  of  the  DSS  changes  were  ill-advised  and  merely  created  new 
problems,  especially  in  quality  control  over  investigations. 

The  failure  of  CCMS  after  its  implementation  in  October  1998  was 
also  a  major  setback.  Finally,  DoD  has  lacked  good  information 
on  the  existing  or  forecasted  workload,  and  related  resource 
requirements,  for  both  the  investigative  and  adjudicative 
portions  of  the  program. 

Over  the  past  two  years,  senior  DoD  managers  have  become  much 
more  involved  in  the  problems  at  DSS  than  had  been  the  case 
previously,  and  have  made  several  major  changes,  beginning  with 
the  appointment  of  LTG  (Ret.)  Cunningham  as  Acting  Director  of 
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DSS  in  June  1999  and  Director  in  December  1999.  Over  the  past 
year,  DSS  has  taken  action  to  implement  GAO  and  IG 
recommendations,  cancel  questionable  DSS  policies,  and  acquire 
Air  Force  assistance  to  remediate  the  CCMS.  Another  Integrated 
Process  Team  reported  to  the  Deputy  Secretary  of  Defense  on  the 
continuing  backlog  problem  in  January  2000,  leading  to  his 
decision  to  outsource  part  of  the  DSS  workload  to  the  Office  of 
Personnel  Management  and  contractors . 

Management  Actions  Needed 

I  would  like  to  recap  the  advice  that  the  OIG,  DoD,  has  provided 
to  the  Department  over  the  past  year  regarding  both  the 
personnel  security  investigative  and  adjudicative  processes. 

In  April  2000,  I  testified  on  the  issues  confronting  DSS  before 
the  Senate  Armed  Services  Committee.  Our  position  at  that  time, 
which  remains  essentially  the  same  today,  was  that  the  DoD  plan 
to  quickly  eliminate  the  backlog  of  overdue  clearances  through  a 
combination  of  outsourcing  and  internal  changes  at  DSS  was 
overly  optimistic.  Specifically,  the  DoD  plan  unrealistically 
assumed  that  DSS  could  close  an  average  of  2,500  cases  per  day, 
starting  in  FY  2000.  In  practice,  however,  DSS  completed  an 
average  of  only  1,500  per  day  in  the  first  eleven  months  of 
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FY  2000  and  was  unable  to  reduce  the  backlog.  We  also 
questioned  the  realism  of  DSS  workload  projections,  believing 
them  to  be  significantly  understated,  and  cautioned  that  it 
would  probably  take  years,  not  months,  to  overhaul  the  entire 
Personnel  Security  Program. 

At  the  April  2000  hearing,  in  audit  reports  and  during  internal 
discussions  within  DoD,  we  advised  that  the  Department  needed 
to : 

•  more  actively  oversee  and  manage  the  workload  at  the  DSS  and 
adjudication  facilities,  with  the  expressed  intent  of 
maintaining  high  standards  for  both  quality  and  timeliness; 

•  implement  performance  metrics  that  will  measure  both  the 
quality  and  timeliness  of  investigative  and  adjudication 
workload; 

•  periodically  assess  and  adjust  the  resource  requirements  for 
DSS,  outsourced  investigative  effort,  and  adjudication 
workload; 

•  develop  a  uniform,  DoD-wide  priority  system  for  security 
clearance  investigations;  and 
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•  improve  DSS  tracking  of  security  clearance  requests  and 
feedback  to  requestors  on  case  status;  and 

•  closely  monitor  management  of  the  Case  Control  Management 
System  and  the  Joint  Personnel  Adjudication  System. 

Prioritizing  Investigations 

All  of  those  actions  remain  very  necessary  today  and  most  of 
them  entail  sustained  senior  management  attention.  Today  I 
will  emphasize  the  last  three  of  those  items,  beginning  with 
our  concern  over  the  need  to  prioritize  the  security  clearance 
investigative  workload,  which  has  been  perhaps  our  most 
controversial  recommendation. 

The  April  2000  IG,  DoD  report  on  Security  Clearance 
Investigative  Priorities  (No.  D-2000-111)  discussed  a  number  of 
DSS  case  management  issues.  The  principal  concern  was  the  lack 
of  a  meaningful  process  for  prioritizing  the  workload.  We 
determined  that  investigative  resources  were  generally  applied 
on  a  first  in,  first  out  basis,  so  that  clearance  requests  for 
important  programs  and  higher  risk  positions  often  languished 
while  investigators  worked  on  routine  cases.  Since  timely 
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investigations  are  a  major  problem,  we  deemed  it  particularly 
unreasonable  not  to  have  a  viable  prioritization  process  that 
both  the  requestors  of  the  clearances  and  the  investigators 
understand. 

The  Office  of  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications  and  Intelligence)  initially  disagreed 
with  the  feasibility  of  developing  an  investigation 
prioritization  method,  but  subsequently  changed  its  position  and 
has  been  working  with  the  Services  and  DSS  to  comply  with  the 
recommendation.  I  am  frankly  disappointed  however  with  the  slow 
progress  and  concerned  that  it  is  so  difficult  to  implement  this 
basic  workload  management  tool. 

Tracking  Clearance  Requests 


In  May  2000,  we  issued  another  report  on  DSS  investigative  case 
management.  Tracking  Security  Clearance  Requests  (No.  D-2000- 
134) .  We  reported  that  DSS  lacked  an  effective  means  for 
tracking  the  status  of  security  clearance  requests  from  the 
other  DoD  components. 

Between  July  and  December  1999,  the  DSS  could  not  identify,  on  a 
case-by-case  basis,  why  12,354  of  302,352  electronic  requests 
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received  did  not  result  in  investigative  cases  being  opened. 

The  DSS  provided  possible  reasons  such  as  changes  in  type  of 
investigation,  duplicate  submissions,  conversions  and 
reinstatements  of  prior  clearances,  and  rejections.  Also  the 
DSS  could  not  explain  why  51,788  of  261,361  investigative  cases 
were  opened  during  that  period  without  electronic  requests, 
although  using  electronic  requests  was  mandatory  and  was 
important  for  maintaining  control  and  improving  efficiency. 
Possible  factors  included  case  analysts  manually  entering  paper 
requests  submitted  into  the  CCMS;  requesting  agencies  submitting 
duplicate  requests  that  case  analysts  had  to  manually  annotate 
as  deleted;  and  the  lack  of  active  acknowledgement  of  request 
receipts,  which  created  the  appearance  that  requests  were  being 
lost.  The  DSS  acknowledged  that  its  case  analysts  spent  an 
excessive  amount  of  their  time  researching  the  status  of 
requests,  decreasing  the  resources  available  for  actually 
completing  cases. 

The  DSS  and  Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications  and  Intelligence)  agreed  with 
the  need  to  track  all  security  clearance  requests  more 
efficiently,  but  the  necessary  corrective  actions  depend 
partially  on  improving  the  CCMS  and  implementing  the  JPAS . 
Because  the  JPAS  will  not  be  operational  until  at  least  FY  2002, 
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we  continue  to  believe  that  DSS  should  be  seeking  interim 
measures.  The  confusion  over  clearance  request  status  wastes 
administrative  resources  and  frustrates  the  DoD  organizations, 
contractors  and  individuals  awaiting  the  clearances.  Coupled 
with  the  slow  turnaround  time  on  clearance  requests,  these 
frustrations  account  for  the  dismal  customer  satisfaction  scores 
for  DSS  in  the  DoD  Biennial  Review  of  Defense  Agencies  for  1999. 
This  survey,  published  in  May  2000,  indicated  that  only  14 
percent  of  responding  DoD  organizations  were  satisfied  with  DSS 
performance  on  personnel  security  investigations. 

Case  Control  Management  System 

The  CCMS  is  the  core  of  the  information  systems  used  by  DSS, 
which  are  currently  termed  the  Enterprise  System.  The  CCMS  is 
itself  a  collection  of  subsystems  whose  integration  with  each 
other  and  with  non-CCMS  systems  has  been  extremely  difficult, 
leading  to  many  of  the  lingering  problems  with  functionality  and 
reliability.  The  need  for  a  modern  DSS  system  with  the 
capabilities  intended  for  CCMS  is  undeniable;  however,  as  has 
often  been  the  case  over  the  last  decade  with  DoD  information 
technology  investments,  execution  of  this  system  acquisition 
project  was  flawed.  In  retrospect,  DSS  and  its  contractors 


badly  underestimated  the  technical  risk  and  failed  to  test 
adequately  to  manage  those  risks. 
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We  are  currently  conducting  an  audit  of  the  CCMS  and  plan  to 
issue  a  draft  report  within  the  next  few  weeks  that  will  discuss 
in  detail  the  reasons  for  the  system's  initial  failure  and  what 
needs  to  be  done  now. 

As  previously  noted,  DSS  has  prudently  turned  to  the  Air  Force 
for  system  acquisition  management  support  and  indications  are 
that  CCMS  is  being  stabilized.  DSS  reported  an  average  of  2,523 
cases  closed  per  day  in  August  2000,  which  is  a  positive  sign, 
assuming  that  this  high  level  of  performance  can  be  sustained. 
Although  the  widely  publicized  CCMS  "crash"  last  July  certainly 
disrupted  DSS  operations  for  a  few  days  and  frequent  repetitions 
of  that  severity  would  be  a  major  problem,  it  is  unreasonable  to 
conclude  from  just  one  outage  that  CCMS  must  be  scrapped. 
However,  we  believe  that  it  must  continue  to  be  intensively 
managed  as  a  high  risk,  DoD  mission  critical  system.  We 
understand  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications  and  Intelligence)  intends  to  designate 
CCMS  as  a  major  acquisition  project,  meaning  there  will  be 
oversight  by  an  Integrated  Process  Team  and  the  Chief 
Information  Officer  at  the  Office  of  the  Secretary  of  Defense 
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level.  This  is  a  prudent  step,  but  does  not  in  itself  guarantee 
close  oversight. 

The  CCMS  will  reach  a  critical  milestone  in  FY  2002,  when  the 
Department  will  decide  whether  to  deploy  an  overall  Enterprise 
System  Architecture  for  DSS .  In  the  interim,  CCMS  must  prove 
that  it  can  process  an  average  of  2,500  case  closings  per  day, 
various  initial  design  inefficiencies  must  be  resolved,  and 
additional  reliability  and  maintainability  testing  is  needed. 

In  addition,  DoD  should  aggressively  benchmark  CCMS  against 
systems  performing  similar  functions  in  the  public  and  private 
sector,  so  that  any  viable  alternatives  are  identified  and  fully 
considered. 

Other  Future  Reports 


In  addition  to  an  audit  report  on  CCMS,  we  are  conducting 
several  other  reviews  related  to  the  personnel  security 
investigation  and  adjudication  processes.  These  reviews  are 
being  closely  coordinated  with  ongoing  General  Accounting  Office 
evaluations  in  these  areas  to  prevent  duplication.  Ongoing  or 
planned  efforts  include  the  following: 
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•  We  plan  to  issue  a  final  report  on  adjudication  facility 
resources  in  the  next  couple  weeks.  The  focus  will  be  that 
the  Department  needs  to  do  more  to  identify  future  workload 
and  budget  adequate  resources  for  the  adjudication  facilities. 
Otherwise,  those  facilities  could  become  bottlenecks  and 
efforts  to  improve  production  in  the  investigation  phase  of 
the  process  could  be  largely  nullified.  We  are  awaiting  the 
Department's  comments  on  our  draft  report. 

•  We  are  auditing  the  Defense  Clearance  and  Investigations 
Index,  focusing  primarily  on  this  data  base's  reliability.  We 
plan  to  issue  a  final  report  in  January  2001. 

•  We  are  auditing  the  process  for  adjudicating  clearances  for 
contractor  employees  and  the  related  provisions  for  appeals. 
Again,  we  plan  to  provide  a  report  early  next  year. 

•  We  plan  to  audit  the  acquisition  of  the  Joint  Personnel 
Adjudication  System,  starting  next  month. 

End-to-End  Focus  Needed 


As  mentioned  at  the  outset  of  this  testimony,  the  enormous  scope 
of  the  Defense  Personnel  Security  Program  makes  it  an  inherently 
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difficult  management  challenge.  The  dispersion  of 
responsibility  for  various  portions  of  the  security  management 
process  across  all  DoD  organizations  and  this  fragmentation  of 
control  over  resources  add  significantly  to  this  difficulty.  It 
is  important  that  the  Department  avoid  piecemeal  solutions,  such 
as  its  ill-fated  attempt  to  address  productivity  and  capacity 
problems  at  DSS  by  arbitrarily  limiting  the  number  of  security 
clearance  requests  that  DoD  components  were  allowed  to  submit. 

We  believe  that,  with  somewhat  stronger  recent  support  from  the 
Office  of  the  Secretary  of  Defense,  DSS  is  making  reasonable 
progress  in  its  second  agency  reengineering  attempt,  although 
not  as  quickly  as  planned  earlier  this  year.  DSS  will  need 
continued  close  oversight  and  adequate  support.  In  addition, 
all  other  DoD  organizations  that  play  roles  in  personnel 
security  management  must  view  the  risks  seriously  and  cooperate 
to  achieve  end-to-end  improvement.  It  is  particularly  important 
that  lingering  confusion  about  the  size  and  definition  of  the 
clearance  backlog  and  the  likely  investigative  and  adjudication 
workload  over  the  next  several  years  be  eliminated,  to  enable 
proper  planning. 

Again,  thank  you  for  considering  our  views  on  this  important 
subject.  This  concludes  my  statement. 
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